Server-Side Template Injection
Summary: PortSwigger research published in 2015 and updated in September 2025 documents Server-Side Template Injection, a vulnerability that occurs when user input is embedded unsafely in template engines such as Twig and FreeMarker, and which can often yield Remote Code Execution rather than the XSS it is frequently mistaken for. The paper defines a detection and exploitation methodology and shows it applied to craft RCE zerodays for two widely deployed enterprise web applications, with generic exploits demonstrated for five popular template engines including escapes from sandboxes built to handle user-supplied templates safely.
What's compelling: The research shows that thirty seconds of documentation reading was enough to gain RCE in unsandboxed Smarty, and that FreeMarker's own documentation warns against letting users upload templates - yet wikis, blogs, marketing applications and CMS platforms expose templates to users by design, turning each vulnerable application into a pivot point on the network.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026